Treatment process and documentation of occurred security incidents

Critical
High
Normal
Low

All security incidents are addressed in a consistent manner to improve security based on what has happened.

In the incident treatment process:

  • the reported incident is confirmed (or found unnecessary to record)
  • the type and cause of incident is documented
  • the risks associated with the incident are documented
  • the risks are re-evaluated and treated if that is necessary after the incident
  • risk mitigation measures or a decision their acceptance is documented
  • people who need to be informed of the results of the incident treatment are identified (including external ones)
  • possible need for a post-incident analysis is determined
Connected other frameworks and requirements:
T06: Turvallisuuspoikkeamien hallinta
32. Security of processing
GDPR
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
16.1.5: Response to information security incidents
ISO 27001
DE.AE-2: Analyze detected events
NIST CSF

Process for initiating data breach treatment

Critical
High
Normal
Low

Our organization has pre-defined procedures through which the detected security breach will be addressed. The process may include e.g. the following things:

  • who are part of a team that is ready to respond to breaches
  • how and along what channel the entire team is immediately notified of the breach
  • the team determines the severity (low, medium, high) of the breach based on predefined criteria
  • the breach management is continued with a larger group according to the severity level
Connected other frameworks and requirements:
24. Responsibility of the controller
GDPR
32. Security of processing
GDPR
16.1.5: Response to information security incidents
ISO 27001
16.1.7: Collection of evidence
5.26: Response to information security incidents
ISO 27001
No items found.